SA-CONTRIB-2013-033 - Simple Corporate theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal’s interface.

The theme doesn’t properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would have to have the ‘administer themes’ permission.

CVE identifier(s) issued

• CVE-2013-1787

Versions affected

• Simple Corporate versions prior to 7.x-1.4

Drupal core is not affected. If you do not use the contributed Simple Corporate theme, there is nothing you need to do.

Solution

Install the latest version:

• Simple Corporate 7.x-1.4

Also see the Simple Corporate project page.

Reported by

• Greg Knaddison of the Drupal Security Team

Fixed by

• saran.quardz the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team